Growing Scrutiny of AI Recommendation Systems Spans Personal Productivity, Consumer Discovery, and Regulatory Oversight

In July 2026, Kenya's Office of the Data Protection Commissioner circulated a 36-page draft Guidance Note on Artificial Intelligence. The document maps the nation's Data Protection Act across a seven-stage AI lifecycle. It mandates Data Protection Impact Assessments for eight high-risk use cases, including content recommendation engines and credit scoring. Additionally, the draft establishes strict 72-hour controller and 48-hour processor breach notification clocks, restricts the use of scraped public data for model training, and guarantees human review for automated decisions.

Kenya AI guidance note

• ▪The Kenyan Office of the Data Protection Commissioner circulated a 36-page draft Guidance Note on Artificial Intelligence in July 2026
• ▪The Kenyan draft Guidance Note on Artificial Intelligence maps the Kenyan Data Protection Act onto every stage of an AI system's existence
• ▪The Kenyan draft Guidance Note on Artificial Intelligence formalizes five distinct actor roles across two annexes and a definitions section

Mandatory DPIA requirements

• ▪The Kenyan draft Guidance Note on Artificial Intelligence mandates a Data Protection Impact Assessment for AI content recommendation engines operating on consumer platforms
• ▪The eight mandatory Data Protection Impact Assessment use cases in Kenya include credit scoring, health diagnostics, facial recognition, content recommendation, student assessment, recruitment screening, fraud detection, and employee productivity monitoring
• ▪The Kenyan draft Guidance Note on Artificial Intelligence lists eight AI use cases that require a Data Protection Impact Assessment outright

Web scraping lawfulness restrictions

• ▪The Kenyan draft Guidance Note on Artificial Intelligence states that publicly accessible personal data does not, of itself, provide a lawful basis for processing it as AI training data
• ▪The European Data Protection Board adopted guidelines on web scraping for generative AI on July 7, 2026, concluding that consent is unlikely to work as a legal basis for training-scale collection
• ▪The Kenyan draft Guidance Note on Artificial Intelligence prohibits repurposing production or operational data for AI training without a fresh legal basis or compatibility assessment

AI lifecycle compliance framework

• ▪The Kenyan draft Guidance Note on Artificial Intelligence outlines a lifecycle framework consisting of seven distinct stages from problem definition to decommissioning
• ▪Stage 4 of the Kenyan AI lifecycle framework requires finalization of the Data Protection Impact Assessment, technical testing of human review, and accuracy validation before live deployment
• ▪Stage 6 of the Kenyan AI lifecycle framework introduces continuing duties including ongoing monitoring for drift, periodic algorithmic auditing, and maintaining a documented incident register

Breach notification processor deadlines

• ▪The Kenyan draft Guidance Note on Artificial Intelligence requires data controllers to notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of a breach
• ▪The Kenyan draft Guidance Note on Artificial Intelligence explicitly includes unauthorized training dataset access, model extraction attacks, and adversarial manipulation of AI outputs within its breach definition

Automated decision human review

• ▪Section 35 of the Kenyan Data Protection Act provides individuals the right not to be subject to decisions based solely on automated processing that significantly affect them
• ▪The Kenyan draft Guidance Note on Artificial Intelligence treats AI-generated inferences, classifications, and recommendations as personal data under Section 2 of the Act
• ▪The Kenyan draft Guidance Note on Artificial Intelligence requires that automated decisions have meaningful human involvement, notify individuals of automation, and provide a human-routed contest mechanism